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EU Regulation laying down additional procedural rules relating to 
the enforcement of GDPR 


The Federation of European Data and Marketing (FEDMA) strongly supports the general objective of the 
Regulation laying down additional procedural rules relating to the enforcement of GDPR to streamline 
cooperation between data protection authorities (DPAs) when enforcing the General Data Protection 
Regulation (GDPR) in cross-border cases. We welcome the proposal’s emphasis (i) on the reliance of 
amicable settlements, (ii) on the different procedural situation between complainants and parties under 
investigation, and (iii) the possibilities for the defendants to submit their views prior to the adoption of the 
final decision. 


There remain nevertheless some areas of improvements, specifically about the information provided to 
the parties under investigation and their right to be heard. Additionally, it is fundamental that this proposal 
remains an instrument to deal with all cross-border cases involving any kind of organization. EU 
policymakers should avoid turning the proposed Regulation into a tool to exclusively address cross-border 
cases involving large online platforms and only one regulator as the lead authority. Finally, we regard this 
proposal as a steppingstone to engage in a more comprehensive dialogue on how to enhance GDPR 
implementation on other key elements of the EU data protection framework in view of the upcoming 
review of the GDPR by the European Commission. 


RECOMMENDATIONS 


Support the clarification of the legal framework for the amicable settlement of complaints; 


Preserve the spelling out in Recital 25 of the essential nature of an investigation by a supervisory 
authority; 


Enhance the extension of the right to be heard by the parties before the EDPB; 
Further the information shared between the LSA and the parties under investigation; 


Strike a balance in achieving transparency on how decisions are taken via Article 65 dispute 
resolutions; 


Streamline the way parties under investigation are heard during the procedure; 
Prevent a misuse of the right of access to administrative documents in Article 21 (2); 


Provide for a harmonized system of sanctions for non-compliance with the confidentiality 
agreement. 


1. Support the clarification of the legal framework for the amicable settlement of complaints 
In its wording, Article 5 could facilitate the use of amicable settlement by DPAs, while clearing up the 
legal implications of amicable settlement for complainants and DPAs. This would enable a more 
expeditious resolution of cases that do not pose important threats to the rights of freedoms of individuals 
which would enable to free up DPAs’ time and resources (1) to focus on the most dangerous cases for 
the rights and freedoms of individuals (2) to allocate more resources to accompany companies in their 
compliance efforts. Nonetheless, it is essential to ensure that the framework's clarification does not 
impose excessive coordination obligations on the Lead Supervisory Authorities (LSAs). Such an outcome 
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might unjustly divest the LSA of its privileges and potentially transform resolutions — initially meant to be 
swift and uncomplicated resolutions benefiting both data subjects and controllers/processors — into 
protracted and complex proceedings. Additionally, this may discourage the amicable resolution of 
disputes. 


2. Preserve the spelling out in Recital 25 of the essential nature of an investigation by a supervisory 
authority 
FEDMA believes that it is important to emphasize that this investigation is not a confrontational process 
between the complainant and the parties under investigation but rather an administrative procedure 
initiated by the supervisory authority in line with its mandated responsibilities under Article 57(1) GDPR. By 
underscoring the distinction in procedural positions between the parties: 
e sets clear and proportionate limits to the complainants’ access to the defendants’ confidential 
information; 
e grants the complainants’ right to a fair hearing exclusively where the decision directly impacts 
their legal position negatively. 


This distinction is essential to ensure a clear understanding on the differences between on the one 
hand the GDPR administrative procedure and on the other hand the litigations that complainants can 
file before competent courts and where they can benefit from wider access to information subject 
to the applicable civil and criminal procedural rules. 


3. Enhance the extension of the right to be heard by the parties before the EDPB 

FEDMA welcomes the expansion of the right to be heard to encompass the EDPB's involvement in cross- 
border cases (Article 24), particularly when disputes are being resolved among different DPAs and when 
the cooperation mechanism, as stipulated by Article 60(ff) of the GDPR, has been activated. In the 
context of cross-border investigations, where the EDPB possesses the authority to settle disoutes between 
SAS, it is indeed implausible that the party under investigation would not be granted the opportunity to 
be directly heard by the EDPB. This right to be heard should also be extended to all cross-border cases 
and not just those cases leading to a dispute resolution by the EDPB as per article 65. Parties under 
investigations should be entitled to request to be heard by the concerned DPAs to present them the 
facts, their defense and answer their questions as the concerned authorities will also shape the final 
administrative decision taken by the LSA. 


4. Further the information shared between the LSA and the parties under investigation 
Following the European Data Protection Supervisor's (EDPS) contribution’, FEDMA believes that the 
Regulation should explicitly provide for the obligation for the LSA to inform the defendant that the file has 
been transferred to the other authorities. The LSA’s sharing of relevant information regarding the 
investigation with the other CSAs marks the beginning of a key phase in the decision-making procedure: 
as part of their right to transparency, the parties under investigation should be made aware of each new 
step. 


5. Strike a balance in achieving transparency on how decisions are taken via Article 65 dispute 
resolutions 
FEDMA strongly welcomes the significant progress of this proposal in strengthening and harmonizing the 
rights of the parties under investigation, including the right to be heard and the confidential treatment of 
the information provided. Equally important, the proposed Regulation clarifies the defendants’ access to 


thttps://edps.europa.eu/system/files/2023-04/23-04-25 edps-contribution-procedural-rules-gdpr-enforcement_en.pdf 
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the administrative file with the only exclusion applicable to the correspondence between DPAs. In this 
regard, we understand that there is an ongoing discussion about the access from the parties involved in 
a procedural case to the correspondence between the relevant authorities which goes beyond the area 
of data protection. While preserving the confidentiality of these exchanges could support an open and 
unrestricted dialogue among authorities to reach consensus, granting access to the correspondence 
could instead enhance the authorities’ accountability, opening up what is sometimes perceived as a 
“black box” where decisions could be taken because supported only by a minority of vocal authorities 
next to a majority of passive regulators. In the context of GDPR procedural cross-border cases, FEDMA 
thus advocates for striking a balance between these two positions. 


6. Streamline the way parties under investigation are heard during the procedure 

FEDMA welcomes the new provisions aimed at upholding the right to a fair hearing by providing the 
parties under investigation the possibility to submit their views (i) on the LSA’s draft decision before it is 
shared with the other CSAs (Art.14), and (ii) on the EDPB’s statement of reasons (Art.24). Additionally, 
Article 17 allows the LSA, where appropriate, to ask for the defendants’ view where a revised decision 
raises new elements compared to the first draft. In this context, we firmly advocate that, in order to fully 
uphold the right to a fair hearing, as outlined in Article 41 of the Charter of Fundamental Rights of the 
European Union, the possibility for the parties under investigation to submit their opinion on the revised 
draft should not be left to the discretion of the LSA. The absence of an obligation on the LSA to request 
the defendants’ view in Article 17 risks to jeopardize the Regulation’s objective to foster harmonization in 
procedural rules as it could lead to divergent practices depending on the authority concerned. As such, 
Article 17 should state that the LSA shall, prior to the submission of the revised draft decision, provide the 
parties under investigation with the possibility to make their views known on the new elements raised in 
the revised draft. 


Finally, though the introduction of fixed deadlines can sometimes be counterproductive in the finalization 
of administrative procedures as it may overlook the specificity and complexity of each case, we believe 
that a more nuanced approach is still possible. Specifically, in the proposed regulation, we point out the 
lack of precise indications on procedural deadlines in relation to the submission of views by the parties 
under investigation over the LSA’s preliminary findings. Currently, Article 14(4) provides that the LSA shall 
set a time-limit within which the defendants can make their views known in writing; beyond this deadline 
the LSA is not obliged to take account of written opinions. In the interests of harmonization and to ensure 
that the defendants can effectively exercise their right to be heard, we strongly recommend that the 
proposed Regulation sets a time limit of no less than one month. The same time limit should be applied to 
the amended version of Article 17. 


7. Prevent a misuse of the right of access to administrative documents in Article 21(2) 

Article 21(2) currently denies third parties’ access requests to the administrative file of the supervisory 
authority in a cross-border case as long as the proceedings are ongoing. Accordingly, a contrario 
interpretation of Article 21(2) could leave room for any third party to apply for (and potentially obtain) 
access to the entire administrative file, including to the parties under investigation’ confidential 
information, once the procedure is closed. In other words, the use of businesses’ confidential information 
by a supervisory authority as part of an investigation should not, in itself, affect the conditions under which 
third parties may have access to them even after the end of the proceedings?. (see). FEDMA therefore 
calls for an amendment of this provision. 


2 Conseil d'Etat's Anticor ruling of October 7, 2022 no. 443826 
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8. Provide for a harmonized system of sanctions for non-compliance with the confidentiality 
agreement 

FEDMA strongly welcomes the provisions of the proposed Regulation aimed at ensuring the treatment of 
confidential information provided by the defendants. Specifically, we support Article 21 whereby, before 
receiving a non-confidential version of the preliminary findings and any other documents in the 
administrative file identified as relevant by the lead supervisory authority to make its views on these 
findings known, the complainant must send a confidentiality statement to the authority in which it 
undertakes not to disclose any information. However, we voice concern about the lack of rules for 
sanctions in the event of non-compliance with this confidentiality agreement by the complainant. FEDMA 
believes that this lack of precision could result in each DPA providing for a different sanction (or even 
none at all), thus running counter to the Regulation's objective of harmonization. The proposed Regulation 
should thus introduce a common system of sanctions regarding the breach of a confidentiality 
agreement which should be applicable to both national and cross-border cases. 
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